AT&T's chief privacy officer told U.S. lawmakers Thursday that the company does not engage in behavioral advertising, but the company has apparently used the controversial technology to sell its products, according to a vendor of such services.

The company does not use behavioral advertising or the controversial method of deep packet inspection in its role as an Internet service provider, Dorothy Attwood, AT&T's chief privacy officer and senior vice president for public policy, said when she testified before the House of Representatives Subcommittee on Communications, Technology and the Internet.

The hearing focused on ISPs using behavioral advertising and deep packet inspection (DPI), a method of intercepting and examining a user's Web traffic. Attwood's testimony did not talk about the company's use of behavioral advertising in its role as an advertiser and its partnership with behavioral advertising vendor AudienceScience.

She seemed to criticize behavioral advertising at the hearing. "Behavioral advertising in its current forms is largely invisible to customers," she told lawmakers. "These new online advertising paradigms must be designed to account for a new set of still-evolving consumer expectations and understandings about how personal information will be used and how personal privacy will be safeguarded."

Attwood told lawmakers AT&T would not use DPI or other behavioral advertising methods without informed customer consent.

AT&T will "avoid thoughtlessly lurching into this realm without proper due diligence," she said. "We will initiate such a program only after testing and validating the various technologies and only after establishing clear and consistent methods and procedures to engage consumers and ensure the protection of, and ultimate consumer control over, consumer information. If AT&T deploys these technologies and processes, it will do so the right way."

But that's not how AT&T partner AudienceScience operates. AudienceScience does not ask for opt-in approval from Web surfers, but instead has its Web site partners disclose their tracking behaviors in their privacy policies. Customers can then opt out of tracking after reading the privacy policy, said Jeff Hirsch, AudienceScience's president and CEO.

"Essentially, there's an implied consent that a consumer is giving, by visiting a site and being able to view that content for free, that they're going to receive advertising," he said. "The idea is to make that advertising more valuable to the advertiser."

AudienceScience does not use deep packet inspection, Hirsch said. Instead, the company uses cookies to track Internet users. AudienceScience doesn't collect personally identifiable information, but it can track Internet users across multiple sites using its service, he added.

Hirsch declined to comment on how long AT&T and ad company MEC Interaction have used his company's services, but one report had AT&T using AudienceScience as early as March 2005.

AudienceScience decided to take down the references to AT&T because of the confusion over its use of behavioral advertising, Hirsch said. "We wanted to make sure we conferred with all the appropriate parties to have consistent messaging," he said. "There were, what I feel to be, some confusing comments made ... about the situation."

AT&T spokesman Michael Balmoris said Attwood was talking about AT&T's role as an ISP, not an advertiser, when she said Thursday that the company does not use behavioral advertising.

"As an ISP, we do not track our customers' data across unrelated Web sites to create a profile for behavioral advertising, or hire other firms to do so on our behalf," he said. "Our relationship with this firm is as an advertiser of AT&T products and services. News reports suggesting that we are engaging in behavioral advertising by selling information of our customers is flat wrong."

AT&T does not control the practices of the ad networks or search engines it places ads with, but it has disclosed in the past that it advertises with those outlets, he added. "Like thousands of other businesses that operate websites, AT&T does business with advertising networks and has partnered with providers of online search," Attwood said in an August letter to Congress.

Privacy advocate Jeffrey Chester called on AT&T to clarify its position about behavioral advertising, including whether the company would support legislation to provide "full customer control" of advertising use of their data. "There may be a tug-of-war going on at AT&T, because it appears they don't have a consistent policy on [behavioral targeting] and privacy," said Chester, executive director of the Center for Digital Democracy.

AudienceScience continues to list several other tech companies as advertisers using its technology, including Amazon.com, AOL, Dell, eBay, Hewlett-Packard, IBM and Verizon Communications. The Web sites using AudienceScience's behavioral advertising technology, according to the company, include AOL, CNet.com, CNNMoney.com, the Los Angeles Times, People, The New York Times, Time and Weather.com.

Privacy advocates have decried most current forms of behavioral advertising as secretive and invasive because Web site operators generally do not ask customers for their consent.

"Behavioral targeting has become a largely invisible data-collection, profiling and targeting behemoth that threatens the privacy of almost all Internet users," Chester said. "Unknown to most of us, BT companies engage in a far-reaching data collection sweep of our online activities. BT identifies the pages we visit, where our mouse is in a page, what we spend in our shopping cart, the content we like, our journey online."

To comment on this article and other PCWorld content, visit our Facebook page or our Twitter feed.